1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
|
class test1
class test10
class test11a
class test11b
class test11c
class test12a
class test12b
class test12c
class test20a
class test20b
class test20c
class test21a
class test21b
class test21c
class test30
class test31a
class test31b
class test40
class test41a
class test41b
class test50
class test51a
class test51b
sid kernel
sid security
common test
{
low_w
med_w
hi_w
low_r
med_r
hi_r
}
class test1
inherits test
class test10
inherits test
class test11a
inherits test
class test11b
inherits test
class test11c
inherits test
class test12a
inherits test
class test12b
inherits test
class test12c
inherits test
class test20a
{
test20ap
test20bp
}
class test20b
{
test20ap
test20bp
}
class test20c
{
test20ap
test20bp
}
class test21a
{
test21ap
test21bp
}
class test21b
{
test21ap
test21bp
}
class test21c
{
test21ap
test21bp
}
class test30
inherits test
class test31a
inherits test
class test31b
inherits test
class test40
inherits test
class test41a
inherits test
class test41b
inherits test
class test50
inherits test
class test51a
inherits test
class test51b
inherits test
sensitivity low_s;
sensitivity medium_s alias med;
sensitivity high_s;
dominance { low_s med high_s }
category here;
category there;
category elsewhere alias lost;
level low_s:here.there;
level med:here, elsewhere;
level high_s:here.lost;
# test 1:
# ruletype: mlsconstrain
# tclass: unset
# perms: unset
mlsconstrain test1 hi_r ((l1 dom l2) or (t1 == mls_exempt));
attribute mls_exempt;
type system;
role system;
role system types system;
role test30r;
role test30r types system;
role test31ra;
role test31ra types system;
role test31rb;
role test31rb types system;
type test40t;
type test41ta;
type test41tb;
allow system system:test1 hi_r;
user system roles system level med range low_s - high_s:here.lost;
user test50u roles system level med range low_s - high_s:here.lost;
user test51u1 roles system level med range low_s - high_s:here.lost;
user test51u2 roles system level med range low_s - high_s:here.lost;
# test 10:
# ruletype: unset
# tclass: test10
# perms: unset
# role: unset
# type: unset
# user: unset
constrain test10 hi_w (u1 == u2);
# test 11:
# ruletype: unset
# tclass: test11a, test11b
# perms: unset
# role: unset
# type: unset
# user: unset
constrain test11a hi_w (u1 == u2);
constrain test11b hi_w (u1 == u2);
constrain test11c hi_w (u1 == u2);
# test 12:
# ruletype: unset
# tclass: intoflow12(a|c), regex
# perms: unset
# role: unset
# type: unset
# user: unset
constrain test12a hi_w (u1 == u2);
constrain test12b hi_w (u1 == u2);
constrain test12c hi_w (u1 == u2);
# test 20:
# ruletype: unset
# tclass: unset
# perms: test20ap, test20bp
# role: unset
# type: unset
# user: unset
constrain test20a test20ap (u1 == u2);
constrain test20b test20bp (u1 == u2);
# test 21:
# ruletype: unset
# tclass: unset
# perms: test21ap, test21bp, equal
# role: unset
# type: unset
# user: unset
constrain test21a test21ap (u1 == u2);
constrain test21b test21bp (u1 == u2);
constrain test21c { test21bp test21ap } (u1 == u2);
# test 30:
# ruletype: unset
# tclass: unset
# perms: unset
# role: test30r
# type: unset
# user: unset
constrain test30 hi_w (u1 == u2 or r1 == test30r);
# test 31:
# ruletype: unset
# tclass: unset
# perms: unset
# role: test31r. regex
# type: unset
# user: unset
constrain test31a hi_w (u1 == u2 or r1 == test31ra);
validatetrans test31b (u1 == u2 or r2 == test31rb);
# test 40:
# ruletype: unset
# tclass: unset
# perms: unset
# role: unset
# type: test40
# user: unset
constrain test40 hi_w (u1 == u2 or t1 == test40t);
# test 41:
# ruletype: unset
# tclass: unset
# perms: unset
# role: unset
# type: test41. regex
# user: unset
constrain test41a hi_w (u1 == u2 or t1 == test41ta);
constrain test41b hi_w (u1 == u2 or t2 == test41tb);
# test 50:
# ruletype: unset
# tclass: unset
# perms: unset
# role: unset
# type: unset
# user: test50
constrain test50 hi_w (u1 == u2 or u1 == test50u);
# test 51:
# ruletype: unset
# tclass: unset
# perms: unset
# role: unset
# type: unset
# user: test51u. regex
constrain test51a hi_w (u1 == u2 or u1 == test51u1);
constrain test51b hi_w (u1 == u2 or u2 == test51u2);
#isids
sid kernel system:system:system:medium_s:here
sid security system:system:system:high_s:lost
#fs_use
fs_use_trans devpts system:object_r:system:low_s;
fs_use_xattr ext3 system:object_r:system:low_s;
fs_use_task pipefs system:object_r:system:low_s;
#genfscon
genfscon proc / system:object_r:system:med
genfscon proc /sys system:object_r:system:low_s
genfscon selinuxfs / system:object_r:system:high_s:here.there
portcon tcp 80 system:object_r:system:low_s
netifcon eth0 system:object_r:system:low_s system:object_r:system:low_s
nodecon 127.0.0.1 255.255.255.255 system:object_r:system:low_s:here
nodecon ::1 ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff system:object_r:system:low_s:here
|
